Linux Kernel vulnerabilities

CVE-2021-42252 [HIGH] CVE-2021-42252: An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux An issue was discovered in aspeed_lpc_ctrl_mmap in drivers/soc/aspeed/aspeed-lpc-ctrl.c in the Linux kernel before 5.14.6. Local attackers able to access the Aspeed LPC control interface could overwrite memory in the kernel and potentially execute privileges, aka CID-b49a0e69a7b1. This occurs because a certain comparison uses values that are not memory sizes.

CVE-2025-38211 [HIGH] CWE-416 CVE-2025-38211: In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free o In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac31e15 ("iw_cm: free cm_id resources on the last deref") simplified cm_id resource management by freeing cm_id once all references to the cm_id were removed. The references are removed either upon

CVE-2024-53096 [HIGH] CVE-2024-53096: In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region( In the Linux kernel, the following vulnerability has been resolved: mm: resolve faulty mmap_region() error path behaviour The mmap_region() function is somewhat terrifying, with spaghetti-like control flow and numerous means by which issues can arise and incomplete state, memory leaks and other unpleasantness can occur. A large amount of the complexity aris

CVE-2025-21735 [HIGH] CWE-787 CVE-2025-21735: In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking i In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in nci_hci_create_pipe() The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate().

CVE-2022-47521 [HIGH] CWE-787 CVE-2022-47521: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_ An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.

CVE-2025-37750 [HIGH] CWE-416 CVE-2025-37750: In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decrypt In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 ("smb: client: allocate crypto only for primary server") and commit b0abcd65ec54 ("smb: client: fix UAF in async decryption"), the channels started reusing AEAD TFM from primary channel to perform synchron

CVE-2019-2214 [HIGH] CVE-2019-2214: In binder_transaction of binder In binder_transaction of binder.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-136210786References: Upstream kernel

CVE-2024-49894 [HIGH] CWE-129 CVE-2024-49894: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix index out of bounds in degamma hardware format translation Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS).

CVE-2024-41042 [HIGH] CWE-787 CVE-2024-41042: In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nf In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: prefer nft_chain_validate nft_chain_validate already performs loop detection because a cycle will result in a call stack overflow (ctx->level >= NFT_JUMP_STACK_SIZE). It also follows maps via ->validate callback in nft_lookup, so there appears no reason to iter

CVE-2021-38166 [HIGH] CWE-190 CVE-2021-38166: In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of- In kernel/bpf/hashtab.c in the Linux kernel through 5.13.8, there is an integer overflow and out-of-bounds write when many elements are placed in a single bucket. NOTE: exploitation might be impractical without the CAP_SYS_ADMIN capability.

CVE-2024-49997 [HIGH] CWE-212 CVE-2024-49997: In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix In the Linux kernel, the following vulnerability has been resolved: net: ethernet: lantiq_etop: fix memory disclosure When applying padding, the buffer is not zeroed, which results in memory disclosure. The mentioned data is observed on the wire. This patch uses skb_put_padto() to pad Ethernet frames properly. The mentioned function zeroes the expand

CVE-2025-37952 [HIGH] CWE-416 CVE-2025-37952: In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_ In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix UAF in __close_file_table_ids A use-after-free is possible if one thread destroys the file via __ksmbd_close_fd while another thread holds a reference to it. The existing checks on fp->refcount are not sufficient to prevent this. The fix takes ft->lock around the section

CVE-2024-39502 [HIGH] CWE-416 CVE-2024-39502: In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi In the Linux kernel, the following vulnerability has been resolved: ionic: fix use after netif_napi_del() When queues are started, netif_napi_add() and napi_enable() are called. If there are 4 queues and only 3 queues are used for the current configuration, only 3 queues' napi should be registered and enabled. The ionic_qcq_enable() checks whether th

CVE-2024-26610 [HIGH] CWE-787 CVE-2024-26610: In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix a memory cor In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix a memory corruption iwl_fw_ini_trigger_tlv::data is a pointer to a __le32, which means that if we copy to iwl_fw_ini_trigger_tlv::data + offset while offset is in bytes, we'll write past the buffer.

CVE-2024-27045 [HIGH] CWE-120 CVE-2024-27045: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potentia In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' Tell snprintf() to store at most 10 bytes in the output buffer instead of 30. Fixes the below: drivers/gpu/drm/amd/amdgpu/../display/amdgpu_dm/amdgpu_dm_debugfs.c:1508 dp_dsc_clock_en_read() error: snprintf

CVE-2022-49059 [HIGH] CWE-416 CVE-2022-49059: In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue t In the Linux kernel, the following vulnerability has been resolved: nfc: nci: add flush_workqueue to prevent uaf Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thre

CVE-2024-0841 [HIGH] CWE-476 CVE-2024-0841: A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel h A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

CVE-2022-47519 [HIGH] CWE-787 CVE-2022-47519: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_ An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.

CVE-2022-49349 [HIGH] CWE-416 CVE-2022-49349: In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in ext4_rename_dir_prepare We got issue as follows: EXT4-fs (loop0): mounted filesystem without journal. Opts: ,errors=continue ext4_get_first_dir_block: bh->b_data=0xffff88810bee6000 len=34478 ext4_get_first_dir_block: *parent_de=0xffff88810beee6ae bh->b_dat

CVE-2022-49114 [HIGH] CWE-416 CVE-2022-49114: In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix use after free in fc_exch_abts_resp() fc_exch_release(ep) will decrease the ep's reference count. When the reference count reaches zero, it is freed. But ep is still used in the following code, which will lead to a use after free. Return after the fc_exch_release()